Filter
Top Products
3-27
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 3 Information About NAT
NAT for VPN
Figure 3-21 shows a VPN client Telnetting to the ASA inside interface. When you use a
management-access interface, and you configure identity NAT according to the “NAT and Remote
Access VPN” or “NAT and Site-to-Site VPN” section, you must configure NAT with the route lookup
option. Without route lookup, the ASA sends traffic out the interface specified in the NAT command,
regardless of what the routing table says; in the below example, the egress interface is the inside
interface. You do not want the ASA to send the management traffic out to the inside network; it will never
return to the inside interface IP address. The route lookup option lets the ASA send the traffic directly
to the inside interface IP address instead of to the inside network. For traffic from the VPN client to a
host on the inside network, the route lookup option will still result in the correct egress interface (inside),
so normal traffic flow is not affected. See the “Determining the Egress Interface” section on page 3-22
for more information about the route lookup option.
Figure 3-21 VPN Management Access
See the following sample NAT configuration for the above network:
! Enable hairpin for non-split-tunneled VPN client traffic:
same-security-traffic permit intra-interface
! Enable management access on inside ifc:
management-access inside
! Identify local VPN network, & perform object interface PAT when going to Internet:
object network vpn_local
subnet 10.3.3.0 255.255.255.0
nat (outside,outside) dynamic interface
! Identify inside network, & perform object interface PAT when going to Internet:
object network inside_nw
subnet 10.1.1.0 255.255.255.0
nat (inside,outside) dynamic interface
VPN Client
209.165.201.10
Internet
Inside
1. Telnet request to ASA inside ifc;
management-access config req’d
4. Telnet request to 10.1.1.1
2. ASA decrypts packet; src address is now local address
Dst: 10.3.3.10 209.165.201.10
7. ASA encrypts packet; dst address is now real address
10.3.3.10
Src: 209.165.201.10
8. Telnet response to
VPN Client
Dst: 209.165.201.10
Dst: 10.3.3.10
10.1.1.1
Src: 10.1.1.1
10.3.3.10
3. Identity NAT between inside &
VPN client NWs; route-lookup req’d
Src: 10.3.3.10
10.1.1.1
Dst: 10.1.1.1
10.3.3.10209.165.201.10
ASA Inside IP:10.1.1.1
5. Telnet response
to VPN Client
Dst: 10.3.3.10
6. Identity NAT
Src: 10.3.3.10
303461